The scenario
It is 9:42am on a Tuesday in the second week of school. Teachers can't load the gradebook, the SIS is unreachable, and the help-desk queue is filling with the same message. A ransom note is on three staff workstations.
First 60 minutes
- Tell building admins to switch to paper attendance and hold normal classes unless safety requires otherwise.
- Disconnect affected segments from the network — do not power off, do not reboot.
- Open the incident channel with district IT, the superintendent, and the comms lead.
- Pull the most recent backup-restore time estimate from your MSP or in-house team.
- If state testing is active, page the state assessment coordinator before parents are notified.
- Draft the first family notice — even one line acknowledging an IT disruption beats silence.
- Open a ticket with K-12 MS-ISAC and your cyber-insurance carrier in the same hour.
Decisions to make
Continuity of instruction
- — Hold normal classes (paper only) — safest if buildings, HVAC, and bus routing are unaffected.
- — Remote day — only if district devices are unaffected and families have 12+ hours' notice.
- — Cancel school — reserve for safety-system impact (HVAC, access control, transportation).
Testing-window edge case
- — State testing in progress: stop the session, document the disruption, page the state assessment coordinator.
- — Testing window opens in <72 hours: notify the state coordinator now; do not wait until restoration.
Who to call
- K-12 MS-ISAC (immediate)
- Cyber-insurance carrier (within the first hour)
- Your state department of education cybersecurity lead
- CISA — if you meet the CIRCIA covered-entity definition
- Local law enforcement / FBI field office (or RCMP in Canada)
- State or provincial breach-notification regulator if student PII is in scope
Family communication template
/playbooks/parent-communication-after-breach#ransomware-template
FAQ
Should we pay the ransom?
Talk to your cyber-insurance carrier and counsel before any payment decision. Most US state and Canadian provincial guidance discourages payment and several states restrict it for public entities.
Do we have to notify families on day one?
You owe families an acknowledgement of disruption immediately. The formal breach notice (if student PII is in scope) follows your state's timeline — FERPA does not set a fixed clock, but state laws like NY Ed Law 2-d, Texas HB 18, and Illinois SOPPA do.
Is this CIRCIA-reportable?
Most K-12 districts are not currently CIRCIA-covered, but larger districts, regional service agencies, and districts that operate as critical infrastructure under state definitions may be. When in doubt, file via CISA — there is no penalty for over-reporting.